Configuration

All settings live under Analytics → Data Settings in your WordPress admin. No wp-config.php edits are needed.

Data Retention

Controls how long raw pageview and heatmap rows are kept in the database. Older rows are pruned automatically by a daily WP-Cron job.

Option valueBehavior
30Keep the last 30 days
90Keep the last 90 days (default)
180Keep the last 6 months
365Keep the last year
0Keep forever (pruning disabled)

You can also trigger pruning immediately from the WP-CLI: wp rsa prune.

Bot Score Threshold

Requests with a bot score equal to or above this value are silently discarded and not recorded. The score range is 0–10.

ThresholdEffect
3 (default)Balanced — catches most bots with minimal false positives
2More aggressive — may catch headless browsers that try to mimic real users
5Lenient — only filters obvious bots; use when you notice legitimate traffic being blocked
10Only filters self-announced crawlers (Googlebot, etc.)

Excluded roles

By default, visits from logged-in users with the manage_options capability (admins) are not tracked. You can extend exclusions to editors, authors, or any role via the Excluded Roles checkbox list in Data Settings.

Network-level disable

On multisite, a network administrator can disable tracking for any sub-site from Network Admin → Analytics → Sites. This sets a network option that the tracker respects before any JavaScript is enqueued — no data is collected from disabled sites.

Available wp_options keys

Option keyTypeDefaultDescription
rsa_retention_daysint90Days to keep data (0 = forever)
rsa_bot_score_thresholdint3Minimum bot score to reject
rsa_excluded_rolesarray['administrator']Roles whose visits are not tracked
rsa_email_report_enabledboolfalseEnable scheduled email reports (Premium)
rsa_email_report_frequencystring'weekly'weekly or monthly
rsa_email_report_recipientstringadmin emailRecipient address for reports
rsa_delete_on_uninstallboolfalseDrop tables and options on uninstall
Options are managed via the standard WordPress Settings API and are sanitized before being saved. They are never exposed via the REST API.